TI-2026-83165 Aliases CVE-2026-105455 GHSA-8whf-jvmp-ghv3

Cross-site scripting in RTIR ticket split and incident creation forms

LOW 24CWE-79Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

RT for Incident Response from 6.0.0 before 6.0.4, by Best Practical Solutions, is affected. The subject of a related ticket is shown without HTML escaping on the Split and Create Incident forms, so a script in the subject runs (CWE-79). An unauthenticated sender of an emailed report can set that subject, and the script then runs in the session of the handler who opens the form, acting with that user's authority in RT.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority. The issue was fixed in version 6.0.4. RTIR 5.0 is not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0041 35th percentileScored 2026-11-07

Fix Fixed RT for Incident Response (Best Practical Solutions): 6.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Best Practical Solutions	RT for Incident Response	6.0.0 to before 6.0.4	6.0.4	Patch available	CNA

RT for Incident Response VendorBest Practical Solutions Affected 6.0.0 to before 6.0.4 Fixed in 6.0.4 Patch available CNA

Remediation

Upgrade RT for Incident Response to version 6.0.4. RTIR 5.0 is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Fix · CNA RT for Incident Response (Best Practical Solutions) Fixed in 6.0.4

Timeline

2026-10-30 Threatist record created from CVE-2026-105455
2026-10-30 CISA SSVC decision points changed
2026-10-30 Alias added: GHSA-8whf-jvmp-ghv3

References

Advisory 1

https://cert.pl/en/posts/2026/10/CVE-2026-105454

Other 1

https://requesttracker.com/rtir/

TI-2003-00254 Cross-site scripting (XSS) vulnerability in the web interface for Request Tracker (RT)… CVSS 2.0MEDIUM 6.8
TI-2024-03059 Information exposure vulnerability in Request Tracker (RT) CVSS 3.1MEDIUM 5.5
TI-2006-02113 RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via… CVSS 2.0MEDIUM 5.0
TI-2026-83166 Stored XSS via HTML scrubber rule in RTIR CVSS 4.0MEDIUM 5.3
TI-2026-83164 Stored XSS via crafted URLs in HTML ticket content in Request Tracker CVSS 4.0MEDIUM 5.3
TI-2012-02390 Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in… CVSS 2.0MEDIUM 4.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences